§Document retrieval
Ask your documents. Check every answer.
Retrieval-augmented generation fixes the input rather than the model. Before the model writes a word, the system searches your own documents, pulls the passages that bear on the question, and hands them over as source material. The answer comes back with citations pointing at the page it came from, so a reviewer can check it in seconds.
The failure mode
A confident wrong answer is worse than no answer.
A general-purpose assistant answers from what it memorized during training. It has never seen your contracts, your protocols or your case files, so when you ask about them it produces something plausible.
Bolting retrieval on top helps, but only partly. A system that retrieves the right passage and then paraphrases it into something the passage does not say has failed in a way that is very hard to notice — the citation is right there, and it looks checked.
The hard part is not finding the document. It is making sure that whatever you end up reading can be traced, word for word, back to a document you were allowed to see.
The pipeline
Seven stages, each one named and timed.
Every stage records its own duration, and the trace is stored alongside the answer. When something is slow or wrong, you can see which stage did it rather than guessing.
- 01Ingest
Structure-aware chunking that respects headings and keeps character offsets into the original document. Those offsets are load-bearing later.
- 02Retrieve
Dense and lexical search run concurrently, each with the authorization predicate inside it, then combined by reciprocal rank fusion.
- 03Expand
Parent sections pulled in under the same scope, so expansion cannot reach a section the reader may not see.
- 04Generate
Schema-constrained output. Sources carry opaque per-request labels and citations are limited to that closed set.
- 05Quote
Quotations sliced from the stored offsets, never written by the model.
- 06Verify
A deterministic numeric and lexical check first, then a second model that did not write the answer for the genuinely ambiguous cases.
- 07Gate
Claims that did not verify are dropped. If too little survives, the answer is withheld rather than shown partial and unlabeled.
Permission-aware retrieval
Filtering results afterwards is not access control.
By the time a restricted passage has been retrieved and put in a prompt, it has been read. The scope has to be inside the query, not applied to its output.
- Post-filter results
What actually happens
Restricted passages are retrieved, enter the prompt, then are hidden from the displayHolds up under review
No - Separate index per group
What actually happens
Works until a document belongs to two groups, or a group changesHolds up under review
Partly - Predicate inside each retrieval arm
What actually happens
A restricted passage is never a candidate, in either the dense or the lexical armHolds up under review
Yes - Row-level security in the database
What actually happens
Even a code path that forgets to set scope raises rather than returning everythingHolds up under review
Yes — and it is the backstop for the above
| Approach | What actually happens | Holds up under review |
|---|---|---|
| Post-filter results | Restricted passages are retrieved, enter the prompt, then are hidden from the display | No |
| Separate index per group | Works until a document belongs to two groups, or a group changes | Partly |
| Predicate inside each retrieval arm | A restricted passage is never a candidate, in either the dense or the lexical arm | Yes |
| Row-level security in the database | Even a code path that forgets to set scope raises rather than returning everything | Yes — and it is the backstop for the above |
Two details matter as much as the mechanism. A refusal for a restricted document is byte-identical to a refusal for a document that does not exist, so the system can’t be probed to find out what is in there. And a document identifier lifted out of someone else’s answer returns nothing, because holding an identifier grants no access on its own.
Questions
Common questions.
- What makes one RAG system better than another?
- Almost entirely the retrieval step, not the model. Most implementations that disappoint are retrieving the wrong passages and then blaming the model for the answer. Retrieval quality is measurable, so it is the thing we measure and report.
- Can it respect our existing permissions?
- Yes, and it should. If a document is restricted, retrieval must never surface it — not filter it out after the fact, because a filtered result has already been read into a prompt. We enforce scope inside each retrieval arm and back it with row-level security in the database.
- What document formats can you ingest?
- PDF, DOCX and Markdown as standard, with structure-aware chunking that respects headings and preserves character offsets into the original file. Those offsets are what make verbatim quotation possible later.